New! View global litigation for patent families

US7487540B2 - Method of, and system for, replacing external links in electronic documents - Google Patents

Method of, and system for, replacing external links in electronic documents Download PDF

Info

Publication number
US7487540B2
US7487540B2 US10500958 US50095804A US7487540B2 US 7487540 B2 US7487540 B2 US 7487540B2 US 10500958 US10500958 US 10500958 US 50095804 A US50095804 A US 50095804A US 7487540 B2 US7487540 B2 US 7487540B2
Authority
US
Grant status
Grant
Patent type
Prior art keywords
object
link
server
content
email
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
US10500958
Other versions
US20050071748A1 (en )
Inventor
Alexander Shipp
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Symantec Corp
Original Assignee
MessageLabs Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Grant date

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRICAL DIGITAL DATA PROCESSING
    • G06F17/00Digital computing or data processing equipment or methods, specially adapted for specific functions
    • G06F17/30Information retrieval; Database structures therefor ; File system structures therefor
    • G06F17/30861Retrieval from the Internet, e.g. browsers
    • G06F17/30876Retrieval from the Internet, e.g. browsers by using information identifiers, e.g. encoding URL in specific indicia, browsing history
    • G06F17/30887URL specific, e.g. using aliases, detecting broken or misspelled links
    • YGENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y10TECHNICAL SUBJECTS COVERED BY FORMER USPC
    • Y10STECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y10S707/00Data processing: database and file management or data structures
    • Y10S707/99941Database schema or data structure
    • Y10S707/99944Object-oriented database structure

Abstract

A content scanner for electronic documents such as email scans objects which are the target of hyperlinks within the document. If they are determined to be acceptable, the hyperlinks are replaced by ones pointing to copies of the objects stored on a trusted server.

Description

This application is the U.S. national phase of international application PCT/GB04/00212, filed 19 Jan. 2004, which designated the U.S. and claims priority to GB Application No. 0309462.0, filed 25 Apr. 2003. The entire contents of these applications are incorporated herein by reference.

BACKGROUND AND SUMMARY

The present invention relates to a method of, and system for, replacing external links in electronic documents such as email with links which can be controlled. One use of this is to ensure that email that attempts to bypass email content scanners no longer succeeds. Another use is to reduce the effectiveness of web bugs.

Content scanning can be carried out at a number of places in the passage of electronic documents from one system to another. Taking email as an example, it may be carried out by software operated by the user, e.g. incorporated in or an adjunct to, his email client, and it may be carried out on a mail server to which the user connects, over a LAN or WAN, in order to retrieve email. Also, Internet Service Providers (ISPs) can carry out content scanning as a value-added service on behalf of customers who, for example, then retrieve their content-scanned email via a POP3 account or similar.

One trick which can be used to bypass email content scanners is to create an email which just contains a link (such as an HTML hyperlink) to the undesirable or “nasty” content. Such content may include viruses and other varieties of malware as well as potentially offensive material such as pornographic images and text, and other material to which the email recipient may not wish to be subjected, such as spam. The content scanner sees only the link, which is not suspicious, and the email is let through. However, when viewed in the email client, the object referred to may either be bought in automatically by the email client, or when the reader clicks on the link. Thus, the nasty object ends up on the user's desktop, without ever passing through the email content scanner.

It is possible for the content scanner to download the object by following the link itself. It can then scan the object. However, this method is not foolproof—for instance, the server delivering the object to the content scanner may be able to detect that the request is from a content scanner and not from the end user. It may then serve up a different, innocent object to be scanned. However, when the end-user requests the object, they get the nasty one.

The present invention seeks to reduce or eliminate the problems of embedded links in electronic documents and does so by having the content scanner attempt to follow a link found in an electronic document and scan the object which is the target of the link. If the object is found to be acceptable from the point of view of content-scanning criteria, it is retrieved by the scanner and stored on a local, trusted server which is under the control of the person or organisation operating the invention. The link in the electronic document is adjusted to point at the copy of the object stored on the trusted server rather than the original; the document can then be delivered to the recipient without the possibility that the version received by the recipient differs from the one originally scanned. Note that it does not matter to the principle of the invention whether the linked object is stored on the trusted server before or after it has been scanned for acceptability; if it is stored first and found unacceptable on scanning, the link to it can simply be deleted.

If the object is not found to be acceptable, one or more remedial actions may be taken: for example, the link may be replaced by a non-functional link and/or a notice that the original link has been removed and why; another possibility is that the electronic document can be quarantined and an email or alert generated and sent to the intended recipient advising him that this has been done and perhaps including a link via which he can retrieve it nevertheless or delete it. The process of following links, scanning the linked object and replacing it or not with an embedded copy and an adjusted link may be applied recursively. An upper limit may be placed on the number of recursion levels, to stop the system getting stuck in an infinite loop (e.g. because there are circular links) and to effectively limit the amount of time the processing will take.

Thus according to the present invention there is provided a content scanning system for electronic documents such as emails comprising:

a) a link analyser for identifying hyperlinks in document content;

b) means for causing a content scanner to scan objects referenced by links identified by the link analyser and to determine their acceptability according to predefined rules, the means being operative, when the link is to an object external to the document and is determined by the content analyser to be acceptable, to retrieve the external object and modify the document by replacing the link to the external object by one to a copy of the object stored on a trusted server.

The invention also provides a method of content-scanning electronic documents such as emails comprising:

a) using a link analyser for identifying hyperlinks in document content;

b) using a content scanner to scan objects referenced by links identified by the link analyser and to determine their acceptability according to predefined rules, the means being operative, when the link is to an object external to the document and is determined by the content analyser to be acceptable, to retrieve the external object and modify the document by replacing the link to the external object by one to a copy of the object stored on a trusted server.

Thus the content scanner can follow the link, and download and scan the object. If the object is judged satisfactory, a copy of it is stored on the trusted server, and the link to the external object replaced by a link to that copy.

One trick used by spammers is to embody ‘web bugs’ in their spam emails. These are unique or semi-unique links to web sites—so a spammer sending out 1000 emails would use 1000 different links. When the email is read, a connection is made to the web site, and by finding which link has been hit, the spammer can match it with their records to tell which person has read the spam email. This then confirms that the email address is a genuine one. The spammer can continue to send email to that address, or perhaps even sell the address on to other spammers.

By following every external link in every email that passes through the content scanner, all the web bugs the spammer sends out will be activated. Their effectiveness therefore becomes much reduced, because they can no longer be used to tell which email addresses were valid or not.

BRIEF DESCRIPTION OF THE DRAWINGS

The invention will be further described by way of non-limiting example with reference to the accompanying drawings, in which:

FIGS. 1A and 1B respectively show the “before” and “after” states of an email processed by an embodiment of the present invention; and

FIG. 2 shows the email processor of a system embodying the present invention; and

FIG. 3 shows an object server for providing objects referenced by links in email which has been rebuilt by the system of FIG. 2.

DETAILED DESCRIPTION OF EXAMPLE EMBODIMENTS

FIG. 1 a shows an email 1 formatted according to an internet (e.g. SMTP/MIME) format. The body includes a hypertext link 2 which points to an object 3 on a web server 4 somewhere on the internet. The object 3 may for example be a graphical image embedded in a web page (e.g. HTML or XML).

FIG. 1 b shows the situation after the email 1′ has been processed by the system to be described below and the content pointed at by the link 2 has been judged to be acceptable. The content, i.e. image 3 has been copied to an object server 5 as image 3′; the object server 5 is hosted on a secure server machine 6 (or array of such machines) under the control of the person or organisation operating the system (e.g. an ISP). The original link 2 has been replaced by a new link 2′ pointing at the image 3′ stored on the secure or trusted server 6. The server 6 operates in the security domain of the operator of the system and has access permissions associated with the stored content objects such as 3′ which enable eventual recipients of emails such as 1, or more strictly speaking their email client software to follow the line 2′ and retrieve the linked-to object. Of course, the access permissions of server 6 should prevent persons or software without appropriate security credentials from writing to the linked-to object storage area.

FIGS. 2 and 3 illustrate a system according to the present invention. Although the invention is not limited to this application, this example embodiment is given in terms of a content scanner operated by an ISP to process email stream e.g. passing through an email gateway.

FIG. 2 shows the part 100 of the system which processes emails and modifies them to replace links to objects on untrusted servers such as 4 by links to objects on trusted server 6, where the linked-to object is considered to be acceptable content. FIG. 3 shows the object server 300 which provides the linked-to objects when recipients follow the processed links in their emails.

The part 100 of the system which is shown in FIG. 2 may operate as follows in respect of each item of email delivered to an input 101.

1. The email is analysed by analyser 102 to determine whether it contains external links. This determination may be made, for example, by scanning it for standard markup tags which point to external content or objects, for example the <A> and <IMAGE> tags in HTML. If none are found, steps 2 to 5 are omitted and the email is delivered unprocessed to output 103 via path 104.

2. The analyser 102 operates in concert with a link replacer 105 to process links to external objects. For each link, the link replacer 105 creates a new link which is stored in a link database 106. The new link is generated by a process guaranteed to generate unique links each time. A database entry is created, tying the original link and the new, replacement, one together.

3. An email rebuilder 107 rebuilds the email with each link replaced by its new counterpart stored in link database 106 and the rebuilt email is forwarded on.

4. When the email is read, the object server 300 illustrated in FIG. 3 comes into play. The new link may be requested either by the email client software, or by the person reading the email clicking or otherwise selecting the link. This generates a request retrieve an object from the trusted server 6. The server 6 looks up in the link database 106 to find the original object, and retrieves it. If it cannot be retrieved, go to step 8.

5. The external objects are scanned for pornography, viruses, spam and other undesirables. If any are found, go to step 8.

6. The external objects are analysed to see whether they contain external links. If the nesting limit has been reached, go to step 8. Otherwise each external link is replaced by a new link in a manner similar to step 2, and a database entry is created, tying the old and new links together.

7. The rebuilt object is forwarded to the requester, and the process ends

8. If processing arrives here, an undesirable object has been found, or the object could not be retrieved, or the nesting limit has been reached. The system can now take some appropriate error action, such as returning an error message, alerting an operator or returning a default object.

FIG. 3 shows the object server 300 which services requests received at an input 301 to retrieve a linked-to object on an entrusted server, scan it for acceptability and, if acceptable, to store it on the secure “safelink” server 6. An object locator 302 locates the linked-to object, e.g. on the internet and initiates a retrieval operation by which the object is retrieved by the retriever 303. This retrieval process takes place using the internet protocol appropriate to the link and linked-to object. If the retrieval fails, an error handler 304 is invoked. If successful, the object is processed by an object control scanner 305 which makes a determination of whether the content is acceptable. If it is not, the error handler 304 is invoked, otherwise an object returner 306 returns the object and stores it on the trusted server 6.

EXAMPLE

The following email contains a link to a website.

Subject: email with link
Subject:
Date: Thu, 9 May 2002 16:17:01 +0600
MIME-Version: 1.0
Content-Type: text/html;
Content-Transfer-Encoding: 7bit
<!DOCTYPE HTML PUBLIC “-//W3C//DTD HTML 4.0
Transitional//EN”>
<HTML><HEAD>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV>&nbsp;</DIV>
This is some text<BR>
<DIV><IMAGE src=“http://www.messagelabs.com/threatlist”
</DIV>
This is some more text<BR>
</BODY></HTML>

A new link is generated: http://safelink.com/09052002161710a33071ef407.gif, the email is updated, and a database entry is generated.
Database Entry
Old link: http://www.messagelabs.com/threatlist.gif
New link: http://safelink.com/09052002161710a33071ef407.gif
Updated email

Subject: email with link
Subject:
Date: Thu, 9 May 2002 16:17:01 +0600
MIME-Version: 1.0
Content-Type: text/html;
Content-Transfer-Encoding: 7bit
<!DOCTYPE HTML PUBLIC “-//W3C//DTD HTML 4.0
Transitional//EN”>
<HTML><HEAD>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV>&nbsp;</DIV>
This is some text<BR>
<DIV><IMAGE src=“http://safelink.com/
09052002161710a33071ef407.gif”
</DIV>
This is some more text<BR>
</BODY></HTML>

When the email is read, the email client may try and download the image referred to by the link. However, it will try and retrieve the image from http://safelink.com/09052002161710a33071ef407.gif rather than http://www.messagelabs.com/threatlist.gif

The safelink.com server will lookup http://safelink.com/09052002161710a33071ef407.gif in the database, and find that the original link is http://www.messagelabs.com/threatlist.gif. It will download the object, and scan it, perhaps for pornography or other inappropriate content.

If the scan shows the object is harmless, it can be passed back to the original requestor.

Example Link Generator

The link can be generated by processing the name of the server generating the link, the current time, the process id, a number that increments each time and random number. This will all be appended to an appropriate reference to the ‘safelink’ server.

Thus if the server generating the link is mail2071.messagelabs.com, the reference is for the http protocol the time is 27 Jan. 2003, 17:45:01 the process id is 1717, 27 references have already been generated and the safelink server is safelink.com, then a typical link might be:

http://safelink.com/mail2071_messagelabs_com/27012003174501/1717/28/10131354834

Other Improvements

Other improvements can be added to the system. For instance, the system does not have to wait until the object is first requested. It may proactively fetch the object ahead of time, scan it, and either cache the object or remember that the scan did not pass. This will cut down on delays when the object is requested. If all links are followed then this will activate all web bugs placed in the email, thereby much reducing their effectiveness.

The system can also cache and intelligently remember which objects have been retrieved—if five emails contain the same original link, then even though they will end up with five different new links the referred to object only needs to be retrieved once and not five times.

The system might want to ensure the same filename extension is used for the old and new links.

Claims (15)

1. A content scanning system for electronic documents such as emails comprising:
a) a link analyser configured to identify hyperlinks in content of electronic documents;
b) a hyperlink replacer configured to modify the electronic documents by replacing hyperlinks to external objects identified by the link analyser by new hyperlinks to respective targets on a trusted server;
c) a link database, the hyperlink replacer being configured to store in the link database data relating the replaced hyperlinks to the new hyperlinks; and
d) an object server hosted on a server machine and configured, on receipt of a request to retrieve an external object from one of said targets on the trusted server when a new hyperlink to said one of said targets is selected, to use the data stored in the link database to determine the replaced hyperlink which was replaced by the new hyperlink, to retrieve the external object referenced by the thus determined, replaced hyperlink, and to cause a content scanner to scan the retrieved external object and to determine the acceptability of the retrieved external object according to predefined rules, the object server being configured, responsive to the replaced hyperlink being to an external object which is determined by the content scanner to be acceptable, to supply the retrieved external object in response to the request, and the object server being configured, responsive to the replaced hyperlink being to an external object which is determined by the content scanner to be unacceptable, to perform remedial action.
2. The system according to claim 1 wherein the link analyser and the object server are configured to recursively process hyperlinks identified in external objects.
3. The system according to claim 2 in which only a maximum depth of recursion is permitted and the document is flagged as unacceptable if that limit is reached.
4. The system according to claim 1 wherein the remedial action comprises one or more of:
flagging or modifying the document to indicate that the content scanner has found the object to be unacceptable;
modifying the document by replacing the hyperlink by a non-functional hyperlink; and
quarantining the document and sending the intended recipient an alert advising the recipient that this has been done.
5. A computer-implemented method of content-scanning electronic documents such as emails comprising:
a) using a link analyser to identify hyperlinks in content of electronic documents;
b) modifying the electronic documents by replacing hyperlinks to external objects identified by the link analyser by new hyperlinks to respective targets on a trusted server and storing data relating said replaced hyperlinks to said new hyperlinks;
c) responsive to a request to retrieve an external object from one of said targets on the trusted server when a new hyperlink to said one of said targets is selected, using the stored data to determine the replaced hyperlink which was replaced by the new hyperlink, retrieving the external object referenced by the thus determined, replaced hyperlink, and using a content scanner to scan the retrieved external object and to determine the acceptability of the retrieved external object according to predefined rules;
d) responsive to the replaced hyperlink being to an external object which is determined by the content scanner to be acceptable, supplying the retrieved external object in response to the request; and
e) responsive to the replaced hyperlink being to an external object which is determined by the content scanner to be unacceptable, performing remedial action.
6. The method according to claim 5 wherein the steps a) through e) are used recursively to process hyperlinks identified in external objects.
7. The method according to claim 6 in which only a maximum depth of recursion is permitted and the document is flagged as unacceptable if that limit is reached.
8. The method according to claim 5, wherein the remedial action comprises one or more of:
flagging or modifying the document to indicate that the content scanner has found the object to be unacceptable;
modifying the document by replacing the hyperlink by a non-functional hyperlink; and
quarantining the document and sending the intended recipient an alert advising the recipient that this has been done.
9. The system according to claim 1, wherein the object server is configured, responsive to the replaced hyperlink being to an external object which is determined by the content scanner to be acceptable, further to store the retrieved external object on the trusted server.
10. The method according to claim 5, wherein the step of supplying the retrieved external object in response to the request, responsive to the replaced hyperlink being to an external object which is determined by the content scanner to be acceptable, further comprises storing the retrieved external object on the trusted scanner.
11. A computer-implemented method of content-scanning electronic documents comprising:
a) identifying first hyperlinks in contents of electronic documents;
b) modifying the electronic documents by replacing the identified first hyperlinks with different second hyperlinks which point to a trusted server;
c) storing data to relate the second hyperlinks to the first hyperlinks;
d) in response to a request received by the trusted server when one of the second hyperlinks is selected, using the stored data to determine the first hyperlink corresponding to the selected second hyperlink and retrieving an object using the determined first hyperlink;
e) scanning the retrieved object in accordance with specified rules;
f) making the retrieved object available in response to the received request if the retrieved object is determined to be acceptable in accordance with the specified rules; and
g) performing remedial action if the retrieved object is not determined to be acceptable in accordance with the specified rules.
12. The method according to claim 11, further comprising:
generating the second hyperlinks based on one or more of a name of the trusted server, a time, a process identifier, a count that increments for each second hyperlink and a random number.
13. An e-mail gateway comprising a trusted server configured to scan e-mail, the trusted server programmed to perform operations comprising:
a) identifying first hyperlinks in contents of e-mails;
b) modifying the e-mails by replacing the identified first hyperlinks with different second hyperlinks which point to a trusted server;
c) storing data that relates the second hyperlinks to the first hyperlinks;
d) in response to a request received by the trusted server when one of the second hyperlinks is selected, using the stored data to determine the first hyperlink corresponding to the selected second hyperlink and retrieving an object using the determined first hyperlink;
e) scanning the retrieved object in accordance with specified rules;
f) making the retrieved object available in response to the received request if the retrieved object is determined to be acceptable in accordance with the specified rules; and
g) performing remedial action if the retrieved object is not determined to be acceptable in accordance with the specified rules.
14. The e-mail gateway according to claim 13, wherein the trusted server is programmed to perform further operations comprising:
identifying a third hyperlink in the retrieved object;
modifying the retrieved object by replacing the identified third hyperlink with a different fourth hyperlink which points to the trusted server; and
storing data that relates the fourth hyperlink to the third hyperlink.
15. The e-mail gateway according to claim 14, wherein the trusted server is programmed to perform further operations comprising:
in response to a request received by the trusted server when the fourth hyperlink is selected, using the stored data to determine the third hyperlink corresponding to the selected fourth hyperlink and retrieving another object using the determined third hyperlink;
scanning the retrieved other object in accordance with specified rules;
making the retrieved other object available in response to the received request if the retrieved other object is determined to be acceptable in accordance with the specified rules; and
performing remedial action if the retrieved other object is not determined to be acceptable in accordance with the specified rules.
US10500958 2003-04-25 2004-01-19 Method of, and system for, replacing external links in electronic documents Active US7487540B2 (en)

Priority Applications (3)

Application Number Priority Date Filing Date Title
GB0309462A GB2400931B (en) 2003-04-25 2003-04-25 A method of, and system for, replacing external links in electronic documents
GB0309462.0 2003-04-25
PCT/GB2004/000212 WO2004097676A1 (en) 2003-04-25 2004-01-19 A method of, and system for, replacing external links in electronic documents

Publications (2)

Publication Number Publication Date
US20050071748A1 true US20050071748A1 (en) 2005-03-31
US7487540B2 true US7487540B2 (en) 2009-02-03

Family

ID=33042175

Family Applications (1)

Application Number Title Priority Date Filing Date
US10500958 Active US7487540B2 (en) 2003-04-25 2004-01-19 Method of, and system for, replacing external links in electronic documents

Country Status (4)

Country Link
US (1) US7487540B2 (en)
EP (1) EP1618492A1 (en)
GB (1) GB2400931B (en)
WO (1) WO2004097676A1 (en)

Cited By (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060053488A1 (en) * 2004-09-09 2006-03-09 Sinclair John W System, method and apparatus for use in monitoring or controlling internet access
US20080010683A1 (en) * 2006-07-10 2008-01-10 Baddour Victor L System and method for analyzing web content
US20080208868A1 (en) * 2007-02-28 2008-08-28 Dan Hubbard System and method of controlling access to the internet
US20080256113A1 (en) * 2007-04-10 2008-10-16 Microsoft Corporation Techniques to associate information between application programs
US20080256187A1 (en) * 2005-06-22 2008-10-16 Blackspider Technologies Method and System for Filtering Electronic Messages
US20100005165A1 (en) * 2004-09-09 2010-01-07 Websense Uk Limited System, method and apparatus for use in monitoring or controlling internet access
US20100217771A1 (en) * 2007-01-22 2010-08-26 Websense Uk Limited Resource access filtering system and database structure for use therewith
US20100217811A1 (en) * 2007-05-18 2010-08-26 Websense Hosted R&D Limited Method and apparatus for electronic mail filtering
US20110197281A1 (en) * 2010-02-08 2011-08-11 Mcafee, Inc. Systems and methods for malware detection
US20140344257A1 (en) * 2013-05-16 2014-11-20 International Business Machines Corporation Detecting a Preferred Implementation of an Operation
US8978140B2 (en) 2006-07-10 2015-03-10 Websense, Inc. System and method of analyzing web content
US9141786B2 (en) 1996-11-08 2015-09-22 Finjan, Inc. Malicious mobile code runtime monitoring system and methods
US9219755B2 (en) 1996-11-08 2015-12-22 Finjan, Inc. Malicious mobile code runtime monitoring system and methods
US9230111B1 (en) * 2013-06-25 2016-01-05 Symantec Corporation Systems and methods for protecting document files from macro threats
US9241259B2 (en) 2012-11-30 2016-01-19 Websense, Inc. Method and apparatus for managing the transfer of sensitive information to mobile devices
US9559997B1 (en) 2016-01-11 2017-01-31 Paul Everton Client agnostic email processing
US9674129B1 (en) 2016-10-05 2017-06-06 eTorch Inc. Email privacy enforcement

Families Citing this family (37)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2391964B (en) * 2002-08-14 2006-05-03 Messagelabs Ltd Method of and system for scanning electronic documents which contain links to external objects
GB2400931B (en) 2003-04-25 2006-09-27 Messagelabs Ltd A method of, and system for, replacing external links in electronic documents
US7457823B2 (en) 2004-05-02 2008-11-25 Markmonitor Inc. Methods and systems for analyzing data related to possible online fraud
US9203648B2 (en) * 2004-05-02 2015-12-01 Thomson Reuters Global Resources Online fraud solution
US8041769B2 (en) * 2004-05-02 2011-10-18 Markmonitor Inc. Generating phish messages
US7992204B2 (en) 2004-05-02 2011-08-02 Markmonitor, Inc. Enhanced responses to online fraud
US20070107053A1 (en) * 2004-05-02 2007-05-10 Markmonitor, Inc. Enhanced responses to online fraud
US20070299915A1 (en) * 2004-05-02 2007-12-27 Markmonitor, Inc. Customer-based detection of online fraud
US7870608B2 (en) * 2004-05-02 2011-01-11 Markmonitor, Inc. Early detection and monitoring of online fraud
US7913302B2 (en) * 2004-05-02 2011-03-22 Markmonitor, Inc. Advanced responses to online fraud
US8769671B2 (en) * 2004-05-02 2014-07-01 Markmonitor Inc. Online fraud solution
US7461170B1 (en) * 2004-09-01 2008-12-02 Microsoft Corporation Zone-based rendering of resource addresses
US7841003B1 (en) * 2005-05-04 2010-11-23 Capital One Financial Corporation Phishing solution method
WO2007005868A3 (en) * 2005-07-01 2009-04-16 Markmonitor Inc Enhanced fraud monitoring systems
US9654495B2 (en) * 2006-12-01 2017-05-16 Websense, Llc System and method of analyzing web addresses
GB0700339D0 (en) * 2007-01-09 2007-02-14 Surfcontrol On Demand Ltd A method and system for collecting addresses for remotely accessible information sources
US8140589B2 (en) * 2007-03-28 2012-03-20 International Business Machines Corporation Autonomic updating of templates in a content management system
US7970761B2 (en) * 2007-03-28 2011-06-28 International Business Machines Corporation Automatic identification of components for a compound document in a content management system
US8074162B1 (en) * 2007-10-23 2011-12-06 Google Inc. Method and system for verifying the appropriateness of shared content
EP2318955A1 (en) * 2008-06-30 2011-05-11 Websense, Inc. System and method for dynamic and real-time categorization of webpages
CA2763513A1 (en) * 2009-05-26 2010-12-02 Roy Barkan Systems and methods for efficient detection of fingerprinted data and information
US8832785B2 (en) 2012-12-06 2014-09-09 Airwatch, Llc Systems and methods for controlling email access
US8862868B2 (en) 2012-12-06 2014-10-14 Airwatch, Llc Systems and methods for controlling email access
US8978110B2 (en) 2012-12-06 2015-03-10 Airwatch Llc Systems and methods for controlling email access
US9021037B2 (en) 2012-12-06 2015-04-28 Airwatch Llc Systems and methods for controlling email access
US8826432B2 (en) * 2012-12-06 2014-09-02 Airwatch, Llc Systems and methods for controlling email access
US8997187B2 (en) 2013-03-15 2015-03-31 Airwatch Llc Delegating authorization to applications on a client device in a networked environment
US9787686B2 (en) 2013-04-12 2017-10-10 Airwatch Llc On-demand security policy activation
US9219741B2 (en) 2013-05-02 2015-12-22 Airwatch, Llc Time-based configuration policy toggling
US9900261B2 (en) 2013-06-02 2018-02-20 Airwatch Llc Shared resource watermarking and management
US9584437B2 (en) 2013-06-02 2017-02-28 Airwatch Llc Resource watermarking and management
US8806217B2 (en) 2013-07-03 2014-08-12 Sky Socket, Llc Functionality watermarking and management
US8775815B2 (en) 2013-07-03 2014-07-08 Sky Socket, Llc Enterprise-specific functionality watermarking and management
US8756426B2 (en) 2013-07-03 2014-06-17 Sky Socket, Llc Functionality watermarking and management
US9665723B2 (en) 2013-08-15 2017-05-30 Airwatch, Llc Watermarking detection and management
US9544306B2 (en) 2013-10-29 2017-01-10 Airwatch Llc Attempted security breach remediation
US20170295202A1 (en) * 2016-04-12 2017-10-12 Microsoft Technology Licensing, Llc Using web search engines to correct domain names used for social engineering

Citations (24)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH09218876A (en) 1996-02-08 1997-08-19 Nec Corp Node link searching device
WO1998018088A1 (en) 1996-10-23 1998-04-30 Access Co., Ltd. Information apparatus having automatic web reading function
US5781901A (en) 1995-12-21 1998-07-14 Intel Corporation Transmitting electronic mail attachment over a network using a e-mail page
WO2000065483A2 (en) 1999-04-27 2000-11-02 Surfnotes, Inc. Method and apparatus for improved device-dependent representation of data
WO2000068764A1 (en) 1999-05-11 2000-11-16 America Online, Inc. Controlling access to content
EP1058199A2 (en) 1999-06-04 2000-12-06 International Business Machines Corporation Internet mail delivery agent with automatic caching of file attachments
JP2001034548A (en) 1999-07-26 2001-02-09 Nec Software Chubu Ltd System and method for electronic mail processing, and recording medium
WO2001033380A1 (en) 1999-11-01 2001-05-10 Genuity Inc. Self-verifying references for internet documents
GB2356474A (en) 1999-07-30 2001-05-23 Ibm System for presenting information from a database
WO2001050344A1 (en) 1999-12-31 2001-07-12 Inca Internet Co., Ltd. System and method for blocking harmful information online, and computer readable medium therefor
US6298444B1 (en) 1997-10-31 2001-10-02 Cisco Technology, Inc. Data scanning network security
US6321242B1 (en) 1998-02-06 2001-11-20 Sun Microsystems, Inc. Re-linking technology for a moving web site
US20030097591A1 (en) * 2001-11-20 2003-05-22 Khai Pham System and method for protecting computer users from web sites hosting computer viruses
US6629138B1 (en) * 1997-07-21 2003-09-30 Tibco Software Inc. Method and apparatus for storing and delivering documents on the internet
WO2004017238A1 (en) 2002-08-14 2004-02-26 Messagelabs Limited Method of, and system for, scanning electronic documents which contain links to external objects
US6701440B1 (en) * 2000-01-06 2004-03-02 Networks Associates Technology, Inc. Method and system for protecting a computer using a remote e-mail scanning device
US20040073631A1 (en) * 2000-01-04 2004-04-15 Keorkunian Gary S. System and method for anonymous observation and use of premium content
US20040088570A1 (en) 2001-12-21 2004-05-06 Roberts Guy William Welch Predictive malware scanning of internet data
US20040117450A1 (en) * 2002-12-13 2004-06-17 Campbell David T. Gateway email concentrator
US20040177042A1 (en) * 2003-03-05 2004-09-09 Comverse Network Systems, Ltd. Digital rights management for end-user content
WO2004097676A1 (en) 2003-04-25 2004-11-11 Messagelabs Limited A method of, and system for, replacing external links in electronic documents
US20040243844A1 (en) * 2001-10-03 2004-12-02 Reginald Adkins Authorized email control system
US20050086499A1 (en) * 2001-05-22 2005-04-21 Hoefelmeyer Ralph S. System and method for malicious code detection
US20050256955A1 (en) * 1999-11-12 2005-11-17 Bodwell Walter R System and method of mediating a web page

Patent Citations (27)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5781901A (en) 1995-12-21 1998-07-14 Intel Corporation Transmitting electronic mail attachment over a network using a e-mail page
JPH09218876A (en) 1996-02-08 1997-08-19 Nec Corp Node link searching device
WO1998018088A1 (en) 1996-10-23 1998-04-30 Access Co., Ltd. Information apparatus having automatic web reading function
US6381637B1 (en) 1996-10-23 2002-04-30 Access Co., Ltd. Information apparatus having automatic web reading function
US6629138B1 (en) * 1997-07-21 2003-09-30 Tibco Software Inc. Method and apparatus for storing and delivering documents on the internet
US6298444B1 (en) 1997-10-31 2001-10-02 Cisco Technology, Inc. Data scanning network security
US6321242B1 (en) 1998-02-06 2001-11-20 Sun Microsystems, Inc. Re-linking technology for a moving web site
WO2000065483A2 (en) 1999-04-27 2000-11-02 Surfnotes, Inc. Method and apparatus for improved device-dependent representation of data
WO2000068764A1 (en) 1999-05-11 2000-11-16 America Online, Inc. Controlling access to content
EP1058199A2 (en) 1999-06-04 2000-12-06 International Business Machines Corporation Internet mail delivery agent with automatic caching of file attachments
JP2001034548A (en) 1999-07-26 2001-02-09 Nec Software Chubu Ltd System and method for electronic mail processing, and recording medium
GB2356474A (en) 1999-07-30 2001-05-23 Ibm System for presenting information from a database
WO2001033380A1 (en) 1999-11-01 2001-05-10 Genuity Inc. Self-verifying references for internet documents
US20050256955A1 (en) * 1999-11-12 2005-11-17 Bodwell Walter R System and method of mediating a web page
WO2001050344A1 (en) 1999-12-31 2001-07-12 Inca Internet Co., Ltd. System and method for blocking harmful information online, and computer readable medium therefor
US20040073631A1 (en) * 2000-01-04 2004-04-15 Keorkunian Gary S. System and method for anonymous observation and use of premium content
US6701440B1 (en) * 2000-01-06 2004-03-02 Networks Associates Technology, Inc. Method and system for protecting a computer using a remote e-mail scanning device
US20050086499A1 (en) * 2001-05-22 2005-04-21 Hoefelmeyer Ralph S. System and method for malicious code detection
US20040243844A1 (en) * 2001-10-03 2004-12-02 Reginald Adkins Authorized email control system
US20030097591A1 (en) * 2001-11-20 2003-05-22 Khai Pham System and method for protecting computer users from web sites hosting computer viruses
US20040088570A1 (en) 2001-12-21 2004-05-06 Roberts Guy William Welch Predictive malware scanning of internet data
US20050055569A1 (en) 2002-08-14 2005-03-10 Alexander Shipp Method of, and system for, scanning electronic documents which contain links to external objects
WO2004017238A1 (en) 2002-08-14 2004-02-26 Messagelabs Limited Method of, and system for, scanning electronic documents which contain links to external objects
US20040117450A1 (en) * 2002-12-13 2004-06-17 Campbell David T. Gateway email concentrator
US20040177042A1 (en) * 2003-03-05 2004-09-09 Comverse Network Systems, Ltd. Digital rights management for end-user content
WO2004097676A1 (en) 2003-04-25 2004-11-11 Messagelabs Limited A method of, and system for, replacing external links in electronic documents
US20050071748A1 (en) 2003-04-25 2005-03-31 Alexander Shipp Method of, and system for, replacing external links in electronic documents

Non-Patent Citations (4)

* Cited by examiner, † Cited by third party
Title
"Look Ahead Filtering of Internet Content" IBM Technical Disclosure Bulleting, IBM Corp, New York, US vol. 40, No. 12 Dec. 1, 1997, p. 143 XP000754118 ISSN: 0018-8689 the whole document.
Greenfield P et al: "Access Prevention techniques for Internet Content Filtering" CSIRIO, DEc. 1999 XP002265027 pp. 7-14 pp. 17-33.
Montebello et al; "Evolvable Intelligent User Interface for WWW Knowledge-Based Systems"; Database Engineering and Applications Symposium, 1998, Proceedings, Ideas' 98 International Cardiff, UK Jul. 8-10, 1998, Los Alamitos, CA, USA, IEEE Comput, Soc, US, Jul. 8, 1998, pp. 224-233, XP010294640.
Wiegel B Ed Association for Computing Machinery: "Secure External References in Multimedia Email Messages" 3rd ACM Conference on Computer and Communications Security New Dehli. Mar. 14-16, 1996 ACM Conference on Computer and Communications Security, New York, ACM, US vol. Conf. 3, Mar. 14, 1996 pp. 11-18 XP000620973 ISBN: 0-89791-829-0 abstract pp. 1-4.

Cited By (34)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9444844B2 (en) 1996-11-08 2016-09-13 Finjan, Inc. Malicious mobile code runtime monitoring system and methods
US9189621B2 (en) 1996-11-08 2015-11-17 Finjan, Inc. Malicious mobile code runtime monitoring system and methods
US9141786B2 (en) 1996-11-08 2015-09-22 Finjan, Inc. Malicious mobile code runtime monitoring system and methods
US9219755B2 (en) 1996-11-08 2015-12-22 Finjan, Inc. Malicious mobile code runtime monitoring system and methods
US20100005165A1 (en) * 2004-09-09 2010-01-07 Websense Uk Limited System, method and apparatus for use in monitoring or controlling internet access
US20060053488A1 (en) * 2004-09-09 2006-03-09 Sinclair John W System, method and apparatus for use in monitoring or controlling internet access
US8135831B2 (en) 2004-09-09 2012-03-13 Websense Uk Limited System, method and apparatus for use in monitoring or controlling internet access
US8141147B2 (en) 2004-09-09 2012-03-20 Websense Uk Limited System, method and apparatus for use in monitoring or controlling internet access
US8015250B2 (en) * 2005-06-22 2011-09-06 Websense Hosted R&D Limited Method and system for filtering electronic messages
US20080256187A1 (en) * 2005-06-22 2008-10-16 Blackspider Technologies Method and System for Filtering Electronic Messages
US8978140B2 (en) 2006-07-10 2015-03-10 Websense, Inc. System and method of analyzing web content
US20080010683A1 (en) * 2006-07-10 2008-01-10 Baddour Victor L System and method for analyzing web content
US9680866B2 (en) 2006-07-10 2017-06-13 Websense, Llc System and method for analyzing web content
US9723018B2 (en) 2006-07-10 2017-08-01 Websense, Llc System and method of analyzing web content
US9003524B2 (en) 2006-07-10 2015-04-07 Websense, Inc. System and method for analyzing web content
US8615800B2 (en) 2006-07-10 2013-12-24 Websense, Inc. System and method for analyzing web content
US8250081B2 (en) 2007-01-22 2012-08-21 Websense U.K. Limited Resource access filtering system and database structure for use therewith
US20100217771A1 (en) * 2007-01-22 2010-08-26 Websense Uk Limited Resource access filtering system and database structure for use therewith
US20080208868A1 (en) * 2007-02-28 2008-08-28 Dan Hubbard System and method of controlling access to the internet
US8015174B2 (en) 2007-02-28 2011-09-06 Websense, Inc. System and method of controlling access to the internet
US20080256113A1 (en) * 2007-04-10 2008-10-16 Microsoft Corporation Techniques to associate information between application programs
US8024652B2 (en) * 2007-04-10 2011-09-20 Microsoft Corporation Techniques to associate information between application programs
US9473439B2 (en) 2007-05-18 2016-10-18 Forcepoint Uk Limited Method and apparatus for electronic mail filtering
US20100217811A1 (en) * 2007-05-18 2010-08-26 Websense Hosted R&D Limited Method and apparatus for electronic mail filtering
US8244817B2 (en) 2007-05-18 2012-08-14 Websense U.K. Limited Method and apparatus for electronic mail filtering
US8799388B2 (en) 2007-05-18 2014-08-05 Websense U.K. Limited Method and apparatus for electronic mail filtering
US20110197281A1 (en) * 2010-02-08 2011-08-11 Mcafee, Inc. Systems and methods for malware detection
US8850584B2 (en) * 2010-02-08 2014-09-30 Mcafee, Inc. Systems and methods for malware detection
US9241259B2 (en) 2012-11-30 2016-01-19 Websense, Inc. Method and apparatus for managing the transfer of sensitive information to mobile devices
US20140344257A1 (en) * 2013-05-16 2014-11-20 International Business Machines Corporation Detecting a Preferred Implementation of an Operation
US9230111B1 (en) * 2013-06-25 2016-01-05 Symantec Corporation Systems and methods for protecting document files from macro threats
US9559997B1 (en) 2016-01-11 2017-01-31 Paul Everton Client agnostic email processing
US9860202B1 (en) 2016-01-11 2018-01-02 Etorch Inc Method and system for email disambiguation
US9674129B1 (en) 2016-10-05 2017-06-06 eTorch Inc. Email privacy enforcement

Also Published As

Publication number Publication date Type
WO2004097676A1 (en) 2004-11-11 application
GB2400931A (en) 2004-10-27 application
US20050071748A1 (en) 2005-03-31 application
GB2400931B (en) 2006-09-27 grant
EP1618492A1 (en) 2006-01-25 application

Similar Documents

Publication Publication Date Title
US7493403B2 (en) Domain name ownership validation
US7739334B1 (en) System and method for automatically forwarding email and email events via a computer network to a server computer
US6735700B1 (en) Fast virus scanning using session stamping
US7152164B1 (en) Network anti-virus system
US6721721B1 (en) Virus checking and reporting for computer database search results
US6826609B1 (en) Policy enforcement in a secure data file delivery system
US8370938B1 (en) Mitigating malware
US8074162B1 (en) Method and system for verifying the appropriateness of shared content
US7506359B1 (en) Method for preventing parasitic usage of web page embedded files
US20070299915A1 (en) Customer-based detection of online fraud
US20030200175A1 (en) System and method for evaluating and enhancing source anonymity for encrypted web traffic
US7120687B1 (en) Monitoring digital images
US7197539B1 (en) Automated disablement of disposable e-mail addresses based on user actions
US20070192853A1 (en) Advanced responses to online fraud
US20050125416A1 (en) Method and apparatus for redirection of server external hyper-link references
US7546349B1 (en) Automatic generation of disposable e-mail addresses
US20020194489A1 (en) System and method of virus containment in computer networks
US20070299777A1 (en) Online fraud solution
US20090106381A1 (en) Network Object Predictive Pre-Download Device
US20120030187A1 (en) System, method and apparatus for tracking digital content objects
US20090043765A1 (en) Server authentication
US7299361B1 (en) Remote e-mail scanning system and method
US20070016951A1 (en) Systems and methods for identifying sources of malware
EP1058199A2 (en) Internet mail delivery agent with automatic caching of file attachments
US20050283837A1 (en) Method and apparatus for managing computer virus outbreaks

Legal Events

Date Code Title Description
AS Assignment

Owner name: MESSAGELABS LIMITED, UNITED KINGDOM

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:SHIPP, ALEXANDER;REEL/FRAME:016066/0505

Effective date: 20040803

AS Assignment

Owner name: SYMANTEC CORPORATION, CALIFORNIA

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:MESSAGELABS LIMITED;REEL/FRAME:022886/0932

Effective date: 20090622

FPAY Fee payment

Year of fee payment: 4

FPAY Fee payment

Year of fee payment: 8